cf43229593dd2f6c3356b0895e7025b0519a6f7b6068430750328bba7e4229a7

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260930-lsqwjaxdph
SHA256 cf43229593dd2f6c3356b0895e7025b0519a6f7b6068430750328bba7e4229a7
MD5 8bd8576a432cb21b8309725150ba638d
SHA1 380e605e6887fbe484b7854ae06480b39738b46b
SHA512 83a2c08ada199eaa9c0115342988013dd03a66d173c4788dd83362130c46a6ad7365379cbe5a0e286243af8d38509b0f1b3232dce45db25522fab65d34deb7ce
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsoP
TLSH
T12A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2231) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 22 IoCs

pid	Process
5160	YIpk4.exe
4116	10GE22lsg8v.exe
4780	XPqe9rl4ePxS.exe
5256	vRyUzMTMw.exe
1584	1mMHXnOlW.exe
4676	RK1rLcwkRH.exe
2560	vVU68l.exe
2084	XTBkuEIZRjeOGy.exe
1148	yFNAc9.exe
6336	v9vvyIJNNRpl.exe
6612	7JIvVb.exe
6872	WxcZR4t1OwqK.exe
7124	9X40jAwy4U.exe
1856	Z6vpO7OavhE.exe
7228	BvjaAlAHE.exe
7500	ORZpwwq4v.exe
7760	dxnRH.exe
8012	s9EydB.exe
7044	cazG2.exe
7792	S1h2yElPJGdwJ.exe
8368	imvcc.exe
8624	hqu6jzxTpXnM.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FP-WIN = "C:\\Windows\\1mMHXnOlW.exe"	vRyUzMTMw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\7JIvVb.exe"	v9vvyIJNNRpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUI = "C:\\Windows\\WxcZR4t1OwqK.exe"	7JIvVb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBPOLL = "C:\\Windows\\Z6vpO7OavhE.exe"	9X40jAwy4U.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTS = "C:\\Windows\\S1h2yElPJGdwJ.exe"	cazG2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCUPDATE = "C:\\Windows\\imvcc.exe"	S1h2yElPJGdwJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\XPqe9rl4ePxS.exe"	10GE22lsg8v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\vRyUzMTMw.exe"	XPqe9rl4ePxS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\vVU68l.exe"	RK1rLcwkRH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICMON = "C:\\Windows\\yFNAc9.exe"	XTBkuEIZRjeOGy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWINNT = "C:\\Windows\\9X40jAwy4U.exe"	WxcZR4t1OwqK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\s9EydB.exe"	dxnRH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUI = "C:\\Windows\\YIpk4.exe"	2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\P-WIN = "C:\\Windows\\10GE22lsg8v.exe"	YIpk4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSFW = "C:\\Windows\\RK1rLcwkRH.exe"	1mMHXnOlW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCIOMON = "C:\\Windows\\XTBkuEIZRjeOGy.exe"	vVU68l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPM = "C:\\Windows\\BvjaAlAHE.exe"	Z6vpO7OavhE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCPXYSVC = "C:\\Windows\\ORZpwwq4v.exe"	BvjaAlAHE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN32, = "C:\\Windows\\dxnRH.exe"	ORZpwwq4v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\cazG2.exe"	s9EydB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSCHED32 = "C:\\Windows\\v9vvyIJNNRpl.exe"	yFNAc9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSERV = "C:\\Windows\\hqu6jzxTpXnM.exe"	imvcc.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\v9vvyIJNNRpl.exe	yFNAc9.exe
File opened for modification	C:\Windows\hqu6jzxTpXnM.exe	imvcc.exe
File created	C:\Windows\vRyUzMTMw.exe	XPqe9rl4ePxS.exe
File created	C:\Windows\1mMHXnOlW.exe	vRyUzMTMw.exe
File opened for modification	C:\Windows\1mMHXnOlW.exe	vRyUzMTMw.exe
File opened for modification	C:\Windows\vVU68l.exe	RK1rLcwkRH.exe
File created	C:\Windows\v9vvyIJNNRpl.exe	yFNAc9.exe
File created	C:\Windows\7JIvVb.exe	v9vvyIJNNRpl.exe
File opened for modification	C:\Windows\dxnRH.exe	ORZpwwq4v.exe
File opened for modification	C:\Windows\imvcc.exe	S1h2yElPJGdwJ.exe
File created	C:\Windows\RK1rLcwkRH.exe	1mMHXnOlW.exe
File created	C:\Windows\ORZpwwq4v.exe	BvjaAlAHE.exe
File created	C:\Windows\S1h2yElPJGdwJ.exe	cazG2.exe
File opened for modification	C:\Windows\YIpk4.exe	2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\XPqe9rl4ePxS.exe	10GE22lsg8v.exe
File opened for modification	C:\Windows\WxcZR4t1OwqK.exe	7JIvVb.exe
File opened for modification	C:\Windows\10GE22lsg8v.exe	YIpk4.exe
File opened for modification	C:\Windows\XPqe9rl4ePxS.exe	10GE22lsg8v.exe
File created	C:\Windows\vVU68l.exe	RK1rLcwkRH.exe
File opened for modification	C:\Windows\XTBkuEIZRjeOGy.exe	vVU68l.exe
File created	C:\Windows\BvjaAlAHE.exe	Z6vpO7OavhE.exe
File opened for modification	C:\Windows\s9EydB.exe	dxnRH.exe
File created	C:\Windows\10GE22lsg8v.exe	YIpk4.exe
File opened for modification	C:\Windows\vRyUzMTMw.exe	XPqe9rl4ePxS.exe
File created	C:\Windows\yFNAc9.exe	XTBkuEIZRjeOGy.exe
File created	C:\Windows\WxcZR4t1OwqK.exe	7JIvVb.exe
File created	C:\Windows\9X40jAwy4U.exe	WxcZR4t1OwqK.exe
File opened for modification	C:\Windows\Z6vpO7OavhE.exe	9X40jAwy4U.exe
File opened for modification	C:\Windows\ORZpwwq4v.exe	BvjaAlAHE.exe
File created	C:\Windows\dxnRH.exe	ORZpwwq4v.exe
File opened for modification	C:\Windows\yFNAc9.exe	XTBkuEIZRjeOGy.exe
File opened for modification	C:\Windows\7JIvVb.exe	v9vvyIJNNRpl.exe
File opened for modification	C:\Windows\S1h2yElPJGdwJ.exe	cazG2.exe
File created	C:\Windows\imvcc.exe	S1h2yElPJGdwJ.exe
File created	C:\Windows\hqu6jzxTpXnM.exe	imvcc.exe
File created	C:\Windows\Z6vpO7OavhE.exe	9X40jAwy4U.exe
File opened for modification	C:\Windows\BvjaAlAHE.exe	Z6vpO7OavhE.exe
File created	C:\Windows\s9EydB.exe	dxnRH.exe
File created	C:\Windows\cazG2.exe	s9EydB.exe
File opened for modification	C:\Windows\cazG2.exe	s9EydB.exe
File opened for modification	C:\Windows\9X40jAwy4U.exe	WxcZR4t1OwqK.exe
File created	C:\Windows\YIpk4.exe	2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\RK1rLcwkRH.exe	1mMHXnOlW.exe
File created	C:\Windows\XTBkuEIZRjeOGy.exe	vVU68l.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
6360	2560	WerFault.exe	101
5508	6872	WerFault.exe	114
9168	5256	WerFault.exe	95
8864	7760	WerFault.exe	126
8920	8012	WerFault.exe	128
8972	7792	WerFault.exe	132
1828	6336	WerFault.exe	109
2600	7228	WerFault.exe	122
8836	4676	WerFault.exe	99

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YIpk4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vRyUzMTMw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XTBkuEIZRjeOGy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9vvyIJNNRpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9X40jAwy4U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RK1rLcwkRH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yFNAc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxnRH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s9EydB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10GE22lsg8v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPqe9rl4ePxS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1mMHXnOlW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7JIvVb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ORZpwwq4v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cazG2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S1h2yElPJGdwJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vVU68l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WxcZR4t1OwqK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Z6vpO7OavhE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BvjaAlAHE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imvcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqu6jzxTpXnM.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_8bd8576a432cb21b8309725150ba638d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4788

C:\Windows\YIpk4.exe
C:\Windows\YIpk4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160

C:\Windows\10GE22lsg8v.exe
C:\Windows\10GE22lsg8v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4116

C:\Windows\XPqe9rl4ePxS.exe
C:\Windows\XPqe9rl4ePxS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4780

C:\Windows\vRyUzMTMw.exe
C:\Windows\vRyUzMTMw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 552
  2⤵
  - Program crash
  PID:9168

C:\Windows\1mMHXnOlW.exe
C:\Windows\1mMHXnOlW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1584

C:\Windows\RK1rLcwkRH.exe
C:\Windows\RK1rLcwkRH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 2412
  2⤵
  - Program crash
  PID:8836

C:\Windows\vVU68l.exe
C:\Windows\vVU68l.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2092
  2⤵
  - Program crash
  PID:6360

C:\Windows\XTBkuEIZRjeOGy.exe
C:\Windows\XTBkuEIZRjeOGy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2084

C:\Windows\yFNAc9.exe
C:\Windows\yFNAc9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2560 -ip 2560
1⤵
PID:6252

C:\Windows\v9vvyIJNNRpl.exe
C:\Windows\v9vvyIJNNRpl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 2308
  2⤵
  - Program crash
  PID:1828

C:\Windows\7JIvVb.exe
C:\Windows\7JIvVb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6612

C:\Windows\WxcZR4t1OwqK.exe
C:\Windows\WxcZR4t1OwqK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 2092
  2⤵
  - Program crash
  PID:5508

C:\Windows\9X40jAwy4U.exe
C:\Windows\9X40jAwy4U.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7124

C:\Windows\Z6vpO7OavhE.exe
C:\Windows\Z6vpO7OavhE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6872 -ip 6872
1⤵
PID:7136

C:\Windows\BvjaAlAHE.exe
C:\Windows\BvjaAlAHE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 2308
  2⤵
  - Program crash
  PID:2600

C:\Windows\ORZpwwq4v.exe
C:\Windows\ORZpwwq4v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7500

C:\Windows\dxnRH.exe
C:\Windows\dxnRH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7760 -s 2212
  2⤵
  - Program crash
  PID:8864

C:\Windows\s9EydB.exe
C:\Windows\s9EydB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 2212
  2⤵
  - Program crash
  PID:8920

C:\Windows\cazG2.exe
C:\Windows\cazG2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7044

C:\Windows\S1h2yElPJGdwJ.exe
C:\Windows\S1h2yElPJGdwJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 2200
  2⤵
  - Program crash
  PID:8972

C:\Windows\imvcc.exe
C:\Windows\imvcc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8368

C:\Windows\hqu6jzxTpXnM.exe
C:\Windows\hqu6jzxTpXnM.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5256 -ip 5256
1⤵
PID:9148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7760 -ip 7760
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 8012 -ip 8012
1⤵
PID:8900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7792 -ip 7792
1⤵
PID:8944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6336 -ip 6336
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7228 -ip 7228
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4676 -ip 4676
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10GE22lsg8v.exe

Path C:\Windows\10GE22lsg8v.exe
Size 804KB
SHA256 08d34e8db14c28de8d7a33b73dce37093f9d3e7c03e6407e561a3a495708321e
MD5 cb0e3ad922e075f4067c2198d1c4bf40
SHA1 9acf46e151c8e0e8816c7180918ca24b6a4b1694
SHA512 42b0ebb145e15e3411e34eda944d49a6dc3f773bc6b31b4c529055698c3ea0ba0d92bbc261795a47a62f74a4e35775610d25fd45b8359f55d2b7c4430a234890
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nso1
TLSH
T1EC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1mMHXnOlW.exe

Path C:\Windows\1mMHXnOlW.exe
Size 804KB
SHA256 e4278d25d06d4a624e6ce65c0a3792c8f9039a4d4b00398fc57112a5b9a686ba
MD5 e3e5e8a9f39ddba0f161025f9e7e8857
SHA1 2d6307671d9e71b5ae649d93c0a019e756133d14
SHA512 f17fc8fea0fa7353dc9b3dafe1edad3173773fe4eddb987c83a1311b2af8153e3d8c47ac027c8105b6ab0ed019da4deff1232a1e0b464ecb64811b9317001fcb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsob
TLSH
T1FD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7JIvVb.exe

Path C:\Windows\7JIvVb.exe
Size 804KB
SHA256 91a00520505a8228d9aaf10559585f49ea17050d20ab8d9ebda746d545ca6f74
MD5 717df89b51104739611abaaff282d07a
SHA1 687e48f72de2963cc91d4cc153cdb9f7630afc4b
SHA512 7253e4cef4831461177f5877974c0759ec24198598dcbec096d1bc55758cd10f34ef34f2de93010d4f94255546a77e33cbabc5ce85d4d3ceab9001f3e9a2b69e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsow
TLSH
T13805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9X40jAwy4U.exe

Path C:\Windows\9X40jAwy4U.exe
Size 804KB
SHA256 9e1e27ce8f45412ed4c3a839a09bcf17620f96e362b4e58bc63ec7890387af60
MD5 c8b5f1b0c7c98ef33b4840673a9a499e
SHA1 b7bbc64fad6f19f5a78cb91b99adb1dee279e4ac
SHA512 5c3723de1deb1e0cc2d09e2da895c082fc4e8f0ef7644b46c17e98d0215e918b814a03f8f274c6e3fc555fb122cb9a73a6186f021eaf578b5098a0e5352beb2d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoQ
TLSH
T18805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BvjaAlAHE.exe

Path C:\Windows\BvjaAlAHE.exe
Size 804KB
SHA256 a7c6adeaac81a416b2947ddb811ddab71e569ad18c1eaef060ec3d535f1b5974
MD5 384a746d1657d7647b0f32df177e71e6
SHA1 ba1b344160ca3bb3bd8f445d443d1ab137b38413
SHA512 43eb3874124cccc21ed761efe77b054b4b780ef1e8e83a56927e80c6e4b7ad8f90b4d4b64667d353c3a00ad11f044d896b882ce7b9c401e540293b455d545022
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsoD
TLSH
T1E005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ORZpwwq4v.exe

Path C:\Windows\ORZpwwq4v.exe
Size 804KB
SHA256 104fd60b0de6dbcbdc1ab381435a031cbced39b9b7a5bcd7f46401c47cd34d3f
MD5 8a4fb0eb18f380f4b8568515ba5e3cd2
SHA1 0cf4f85ace98655cce453e1b5abc8d469c012b91
SHA512 59a166e21284009b98a1d0ff362d12532c0437ea76ce062f108d15555b032c135db7fe0675f7c604c079b4e1804904e68900c2e2fe327e8224a8f750340cc95a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsos
TLSH
T19F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RK1rLcwkRH.exe

Path C:\Windows\RK1rLcwkRH.exe
Size 804KB
SHA256 d9f4db31fc64c719b194d8add87096fd9f349faaa633c17ac8e0c92e579e9558
MD5 ab92cae5e33cb69575b0c08641290abf
SHA1 42a310d0facfa5ec1068e05ace4deab6fafaada8
SHA512 3459cd105370cd6b9bb6f5380a172fd760c3e8316207e68254caceb126d865bc5f89414b9638c86a38ec189596626be1b527116b655d010ae992924b86d95df8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsof
TLSH
T13905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S1h2yElPJGdwJ.exe

Path C:\Windows\S1h2yElPJGdwJ.exe
Size 804KB
SHA256 23f2c7742c92db34f41d4d0036891834f52c9f2534cce5623c4fff9199d5b2ff
MD5 037ff1752d9447460aa29619bb9e0b8f
SHA1 b3dc2a7751194f67f99e068d80ff6ced4c466303
SHA512 ea4b92299441226e863eb3ee55a2047f3447561129b92974fdcebaf142901ff00fdc3c7c01c43b8c72974ae1b0430fdb17a89c6c2208eac1fdee1089da02ef44
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoG
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WxcZR4t1OwqK.exe

Path C:\Windows\WxcZR4t1OwqK.exe
Size 804KB
SHA256 d6c9d98cfc22ad38002886af4b1014d07778c3f41b4dd2d1c33bc4176ecd9e0f
MD5 3f862189b5ecb079b3644bc1a1375dc5
SHA1 fe8604f54c3295158c18fbddf2cdbdf7aa9a4af0
SHA512 44c61319403a7a41fac1088bc6435c8d6ff8e0f64ea13991d97bf5bceb855a4e07818e506c5063a35fd01eecca1424feb65880b23cdc091e074e641e82497bcc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsok
TLSH
T1AF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPqe9rl4ePxS.exe

Path C:\Windows\XPqe9rl4ePxS.exe
Size 804KB
SHA256 41a55af692142a50bf8f9270159334439adbb2b6747894beb28e348f54886596
MD5 a91a8ec39317423c5b08d1d4fd1002e6
SHA1 d3da94db24af80cb25f58767b07ed6749ff98151
SHA512 482bb58963e3f8d51c93a71359b1d43f1feb242d41596dae20fe2afe61769aa5bfd00138a342cdf55188a3d43838e118dbe622f676db4755b6600cd7849680ca
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsoe
TLSH
T1BC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XTBkuEIZRjeOGy.exe

Path C:\Windows\XTBkuEIZRjeOGy.exe
Size 804KB
SHA256 3e18a52a5a7228cc88b017dccfa605080a2176b5e8082aa2c0d61e398a37c9f2
MD5 ab9751f0dd69c504bdb1b761e01ee7a5
SHA1 455c1e46d9a91fd1c61f791e0286df21813e6bd2
SHA512 60a788c34760ce99e2665ffcbcf2405c6cac710e5848d14591291491d9f6554c98f9aa1c0e7e7b3f8b886c803edce6156b3e87c70d212059bc701e88ae0044e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso9
TLSH
T1AB05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIpk4.exe

Path C:\Windows\YIpk4.exe
Size 804KB
SHA256 ae0d4430019acda508f23e63c189739d78199b5f44edd2b9bf6b0cdc279842ae
MD5 2e547c665e129b57c5242dbb406f12d4
SHA1 ccddd14c69a9ca2cdf0af5c7a8b1687e335ad131
SHA512 d65167b4ddbfce3fca7b36bb14ec6f35dded79ba5f846f6793f26ea6617e8c955dcc3d5ec953cf39311fb8dc6725213998e9922c380dc912b0b911ea06f35cab
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoS
TLSH
T1F205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z6vpO7OavhE.exe

Path C:\Windows\Z6vpO7OavhE.exe
Size 804KB
SHA256 998f69197feb16686ca9de05c2793a6673c8fbd945a5bc3f0ad11081f6fe45fa
MD5 00d536d144e1666bd20e83acaa5cb4fa
SHA1 a23e651131717fbf6d89d0df87db6fc0dc95c5f1
SHA512 b2f13d13d6d623e12d019106e78d8cb106c00cae97a9811752368a711e262d6b99fd45791ea813081cfe3c7504f987f92a7cf56b633d0ba8f7f8c46dc3fada54
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsof
TLSH
T11E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cazG2.exe

Path C:\Windows\cazG2.exe
Size 804KB
SHA256 a2abb8968cc1922d2b521f9bb739968a4ef76fafddf32c049e5d67a8ed47ccd2
MD5 5b4e7525c748124709c43c45d22cfe05
SHA1 1b34853dfa57b7b973973d6a53d1a07561983fb0
SHA512 591cedc8a213f660aa5a9307edb1b542d7151729a75ecf6e7db56bf12b0ac5a17cf1d9da4c743374e3952471d7e1d78a5cf86eda5fd987aa9e50c6898f5b6304
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsov
TLSH
T11505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxnRH.exe

Path C:\Windows\dxnRH.exe
Size 804KB
SHA256 2b64acff069b421f31e71793e6baa635434190373cd5b1b9dd1209e2e6012f59
MD5 cb322442b40501a8c952990608522431
SHA1 440fd25252da1f74209af53f53f14560ea78cfea
SHA512 7455858d4bcb5bb76cbac482b261e788a9b7a73ff5c5698c312cd85ad83d9b69fd9684705c77ff310f24082adf4af0aaf8a846363213dc728264154cfe12470d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoE
TLSH
T15E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hqu6jzxTpXnM.exe

Path C:\Windows\hqu6jzxTpXnM.exe
Size 804KB
SHA256 e6902d9278bc7dc3d7ee00e9fa42f0faba07096eadddc7423b69443b086fc2c8
MD5 5944e12e83365d61de011977c37c3378
SHA1 190964c166d2d653edcb40b2b4afa5a17f0538f6
SHA512 713b75d8e70404f36697f68cb3b2264e27755a376fd5536cb5d4a27d11132677075097006fdbd305b0274b4b18c374388ff096e12dc507846e571b7b7f08871f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoC
TLSH
T11105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imvcc.exe

Path C:\Windows\imvcc.exe
Size 804KB
SHA256 e2cf4007dc0cb74d5b37ff238a0cb9edcb4ded24e365d88b1825c907970868ae
MD5 af39a87bfc2ebac50ac551b7576f68bc
SHA1 604c2aff412ef5aa161ea7bb3971eaf2dbb0e043
SHA512 e98cf1325c3c5162231e7b4d408181709d1cac0c1af77bae261b720e67957f16a5e37df3c0d2e659b47866f80ce5bd683ba58db48c6114aac0798ab3288ebfe3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsoJ
TLSH
T12705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s9EydB.exe

Path C:\Windows\s9EydB.exe
Size 804KB
SHA256 685c87bc2ff2c9f50da03bfea871a90ac030a250b1c85404e38c42781dd97f37
MD5 43ebe6c3308677f55ac5e5cedb70c79e
SHA1 be3d2c64fc51c1fe8ae7a08963c768ea1b5cecb5
SHA512 503fe58f2c66595b0a287a30f17a455c1ae1f5d721dadf890f9ffb7fc0765ecd9c8ce2138ded8679223de25338e0caa307eb566650f421dcccdc5c8af0feae9d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsoP
TLSH
T18B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v9vvyIJNNRpl.exe

Path C:\Windows\v9vvyIJNNRpl.exe
Size 804KB
SHA256 a41c5768c555efa646c23fcee94220170707e69bfa700d06e3421740192b15f7
MD5 9d1fd73ecfe8efcc7dc5f121bd9abc77
SHA1 4f3dcb6efa25a4bced7eae042d3f44a80c90c94b
SHA512 122f2d4ba1854597f45e0aa814e8d36289737e3bcc6901e807860b2e0fd23928f6c249e01564418815587857a506cf4df894fd9a6c669c21564288054469d204
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nso1
TLSH
T1C805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vRyUzMTMw.exe

Path C:\Windows\vRyUzMTMw.exe
Size 804KB
SHA256 bb094760487d28912925d2b1192872191ae803e65d12d1921de61e41d0a2cb4a
MD5 52a6104d534a39b9f9112846389d2ec8
SHA1 fee959ebef0fcf490951fb955652a3423efeeba5
SHA512 79b38a91c63f3b0ac30f036cbad5716beab28c6501e626602d435472075f98ded65ddbeb8e84ae5e90eed3049928fb657e9faa40f97e2b6c53662691f8f4330a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsoc
TLSH
T11005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vVU68l.exe

Path C:\Windows\vVU68l.exe
Size 804KB
SHA256 02cbe7e325bc53af1bd087d1168c5012d3aeaa8cecedbbfe7b64f1acdc336846
MD5 eda8e9c01b8c2d6fcbade25782564d3d
SHA1 6c0b669eb275d2d482d4c9bdaa433562bb88a07a
SHA512 8ae674418d965e3250afde65f2ae9dd5f620b43f20381d862b6b6f18a994e27d65780c0c62eae009e05a7427e96ffc8fec1d0ef09cec8bdbba85d0aa121dcc8d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoV
TLSH
T14905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yFNAc9.exe

Path C:\Windows\yFNAc9.exe
Size 804KB
SHA256 827362f3e203084ae94f7cf4e03ed893827479e1ae3003169ab46bad5524f42a
MD5 e3b3ffde9d845337290483a57b88b334
SHA1 aab28591d5d74d2b4989612c4c3602015f2b120e
SHA512 35f923b573c06597d8cce27f945bd1f03b802110fa11cf007e97d9732344f243bac6d72d76d269a9f2057203917d73ce059c799540aebac53e6a1afdb1908618
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoI
TLSH
T19605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads